CVE-2011-5193 WHOIS <= 1.4.2.4 - Cross-Site Scripting
LowCVSS 2.6
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpace samswhois | <= 1.4.2.3 | No fix listed |
| phpace samswhois | = 1.1 | No fix listed |
| wordpress-whois-search(WordPress) | <= 1.4.2.4 | No fix listed |
References
- 47428 third-party-advisory vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org